MCP — The Cyber Toolchain

Put Cyber Toolchain in your assistant

The MCP server hands an AI assistant the whole archive directly — every issue, full-text search across it, a tool's release history, its captured command-line flags and examples, its SBOM, and the analytics charts as data. Ask your assistant a question about the market instead of reading a page and telling it what you found. Researcher and Business.

Endpoint https://mcp.cybertoolchain.io/mcp

Streamable HTTP, JSON-RPC 2.0. Not the same host as the REST API — that one is a different distribution and answers 403 here. The same ctk_… key authenticates both.

1 Get a key

Generate one on your account page. It is shown once, so store it when you make it. Then export it — every snippet below reads it from the environment rather than embedding it, so nothing you paste into a config file carries a credential.

shell

export TOOLCHAIN_API_KEY="ctk_…"

Keys are a Researcher and Business feature, and the server enforces it on every request — there is no free tier here. Within that, Docs Weekly and the undredacted vendor names in the charts are Researcher and above; where a tier withholds something the reply says so rather than silently omitting it.

2 Add the server

Pick your client. Each registers the server as cybertoolchain.

Claude Code

One command. Streamable HTTP, no bridge process.

Run this

claude code

claude mcp add --transport http cybertoolchain https://mcp.cybertoolchain.io/mcp \
  --header "Authorization: Bearer $TOOLCHAIN_API_KEY"

Or write this

.mcp.json

{
  "mcpServers": {
    "cybertoolchain": {
      "type": "http",
      "url": "https://mcp.cybertoolchain.io/mcp",
      "headers": {
        "Authorization": "Bearer ${TOOLCHAIN_API_KEY}"
      }
    }
  }
}

watch outYour shell expands $TOOLCHAIN_API_KEY before Claude Code ever sees it, so the command above writes the KEY ITSELF into ~/.claude.json. The .mcp.json form keeps ${TOOLCHAIN_API_KEY} as a placeholder and resolves it at launch — prefer it if the file is anywhere near a git repo. Add --scope user to the command to register the server for every project rather than the current one.

Codex

One command, or the equivalent block in ~/.codex/config.toml.

Run this

codex

codex mcp add cybertoolchain \
  --url https://mcp.cybertoolchain.io/mcp \
  --bearer-token-env-var TOOLCHAIN_API_KEY

Or write this

~/.codex/config.toml

[mcp_servers.cybertoolchain]
url = "https://mcp.cybertoolchain.io/mcp"
bearer_token_env_var = "TOOLCHAIN_API_KEY"

watch outCodex sends a bearer token and nothing else — it has no arbitrary-header option. That is why this server accepts Authorization: Bearer alongside x-api-key; a config that tries to set x-api-key here will not work.

Claude Desktop

Config file only — Settings → Developer → Edit Config.

claude_desktop_config.json

{
  "mcpServers": {
    "cybertoolchain": {
      "url": "https://mcp.cybertoolchain.io/mcp",
      "headers": {
        "Authorization": "Bearer YOUR_API_KEY_HERE"
      }
    }
  }
}

watch outClaude Desktop does not expand environment variables in this file, which is why the placeholder is spelled out rather than written as a variable. The key is stored in plain text on disk — revoke and reissue it at /account if the machine is shared.

opencode

Config file only — opencode has no add command.

opencode.json

{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "cybertoolchain": {
      "type": "remote",
      "url": "https://mcp.cybertoolchain.io/mcp",
      "enabled": true,
      "headers": {
        "Authorization": "Bearer {env:TOOLCHAIN_API_KEY}"
      }
    }
  }
}

Cursor, Windsurf, Zed, Kiro, Continue

Clients that speak stdio only. mcp-remote bridges them to the HTTP endpoint; the config shape is the same in all of them.

mcp.json

{
  "mcpServers": {
    "cybertoolchain": {
      "command": "npx",
      "args": [
        "-y",
        "mcp-remote",
        "https://mcp.cybertoolchain.io/mcp",
        "--header",
        "Authorization:Bearer ${TOOLCHAIN_API_KEY}"
      ]
    }
  }
}

watch outExport TOOLCHAIN_API_KEY in the environment the editor launches from — deliberately not an "env" block, because these files are workspace-scoped and a key inside a repo is the most common way one reaches a git history. On a shared host, treat a bridged key as visible to other users: the bridge takes its header as a command-line argument, and ps shows every process’s full argv.

3 Check it worked

Ask your assistant to list the tools it now has, or hit the endpoint directly — the reply tells you which half is wrong, the URL or the header.

shell

curl -s https://mcp.cybertoolchain.io/mcp \
  -H "content-type: application/json" \
  -H "Authorization: Bearer $TOOLCHAIN_API_KEY" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}'

A tool list — you are connected.

401 with An API key is required — right host, no usable key. Either the header never arrived (check your client expanded TOOLCHAIN_API_KEY) or the key does not resolve. A key that does not resolve is always a 401: the server never quietly downgrades a bad key to the free tier.

403 — wrong host. You are pointed at the REST API's distribution, not this one.